CN108492104B - A resource transfer monitoring method and device - Google Patents

Abstract

Embodiments of the present application provide a method and device for monitoring resource transfer. The method includes: performing a first risk identification on a target account according to a resource transfer request to obtain a first risk identification result; performing a first risk identification on the target account according to the resource transfer request. The second risk identification is obtained, and the second risk identification result is obtained; according to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined. In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Description

A resource transfer monitoring method and device

technical field

The present application relates to the field of computer technology, and in particular, to a resource transfer monitoring method and device.

Background technique

At present, with the rapid development of mobile payment technology, it has brought great convenience to people's daily life. However, it has also created the possibility for cybercriminals to commit cyber fraud, and cyber fraud activities have increased accordingly. One after another, according to statistics, thousands of fraudsters are spending resources to sell stolen goods every day, and each fraudster involves about dozens of victims. For example, Xu Yuyu's telecom fraud and other cases have also aroused public attention and thinking.

At present, the management and control methods of online fraud and sales of stolen goods are mainly: verify and control the complaints reported by victims, but often fraudsters usually transfer resources quickly and complete the sales of stolen goods in a short period of time. Therefore, receiving complaints from victims , and then to the process of characterization as fraudulent behavior, the fraudster has transferred the resources of the account for the disposal of stolen goods, and the management and control timeliness is relatively poor, and it is impossible to timely prevent and control the fraudulent behavior of the fraudster, and thus cannot prevent the fraudster’s resources in time. transfer.

It can be seen from this that in the prior art, only post-event management and control of the complained fraudulent behavior is carried out, and real-time monitoring of resource transfer is not performed, and the timeliness of management and control of fraudulent and stolen resource transfer is poor.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present application is to provide a resource transfer monitoring method and device, which can automatically monitor the real-time resource transfer of a target account, timely detect suspicious accounts with fraudulent sales of stolen goods, and minimize the losses of victims. The result of the transfer-in risk identification and the transfer-out risk identification result determines the final resource transfer risk monitoring result, which improves the accuracy of the determination of fraudulent sales of stolen goods.

In order to solve the above-mentioned technical problems, the embodiments of the present application are implemented as follows:

The embodiment of the present application provides a resource transfer monitoring method, including:

Perform the first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result;

Perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

According to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined.

The embodiment of the present application provides a resource transfer monitoring method, including:

Use the first risk identification model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

Use the second risk identification model to perform second risk identification on the target account according to the resource transfer request, and obtain a second risk identification result;

The third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

The embodiment of the present application provides a resource transfer monitoring device, including:

a first risk identification module, configured to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

A second risk identification module, configured to perform a second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

The monitoring result determination module is configured to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

The embodiment of the present application provides a resource transfer monitoring device, including:

a first risk identification module, configured to use the first risk identification model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

a second risk identification module, configured to use the second risk identification model to perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

The monitoring result determination module is configured to use the third risk identification model to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

An embodiment of the present application provides a resource transfer monitoring device, including: a processor; and

memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Perform the first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result;

Perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

According to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined.

An embodiment of the present application provides a resource transfer monitoring device, including: a processor; and

memory arranged to store computer-executable instructions which, when executed, cause the processor to:

Use the first risk identification model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

Use the second risk identification model to perform second risk identification on the target account according to the resource transfer request, and obtain a second risk identification result;

The third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

Embodiments of the present application provide a storage medium for storing computer-executable instructions, where the executable instructions implement the following processes when executed:

Perform the first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result;

Perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

According to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined.

Embodiments of the present application provide a storage medium for storing computer-executable instructions, where the executable instructions implement the following processes when executed:

Use the first risk identification model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

Use the second risk identification model to perform second risk identification on the target account according to the resource transfer request, and obtain a second risk identification result;

The third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

In the resource transfer monitoring method and device in the embodiments of the present application, the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained; the second risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained. 2. Risk identification result; according to the first risk identification result and the second risk identification result, determine the resource transfer risk monitoring result of the target account. In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments described in this application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a first schematic flowchart of a resource transfer monitoring method provided by an embodiment of the present application;

2 is a schematic diagram of an implementation principle of determining a first risk identification result in a resource transfer monitoring method provided by an embodiment of the present application;

FIG. 3 is a second schematic flowchart of a resource transfer monitoring method provided by an embodiment of the present application;

4 is a schematic diagram of an implementation principle of determining a second risk identification result in a resource transfer monitoring method provided by an embodiment of the present application;

FIG. 5 is a third schematic flowchart of a method for monitoring resource transfer provided by an embodiment of the present application;

6 is a schematic diagram of the realization principle of determining a resource transfer risk monitoring result in a resource transfer monitoring method provided by an embodiment of the present application;

7 is a schematic diagram of the realization principle of the resource transfer risk identification of the target account in the resource transfer monitoring method provided by an embodiment of the present application;

FIG. 8 is a fourth schematic flowchart of a resource transfer monitoring method provided by an embodiment of the present application;

FIG. 9 is a first schematic flowchart of a resource transfer monitoring method provided by another embodiment of the present application;

10 is a second schematic flowchart of a resource transfer monitoring method provided by another embodiment of the present application;

11 is a third schematic flowchart of a resource transfer monitoring method provided by another embodiment of the present application;

FIG. 12 is a schematic diagram of a first module composition of a resource transfer monitoring device provided by an embodiment of the present application;

13 is a schematic diagram of the composition of a second module of the resource transfer monitoring device provided by the embodiment of the present application;

FIG. 14 is a schematic structural diagram of a resource transfer monitoring device provided by an embodiment of the present application.

Detailed ways

In order to make those skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described The embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the scope of protection of this application.

The embodiments of the present application provide a resource transfer monitoring method and device, which can automatically monitor the real-time resource transfer of a target account, timely detect suspicious accounts with fraudulent sales of stolen goods, and minimize the losses of victims. The risk identification result and the transfer-out risk identification result determine the final resource transfer risk monitoring result, which improves the accuracy of the determination of fraudulent sales of stolen goods.

FIG. 1 is a first schematic flowchart of a method for monitoring resource transfer provided by an embodiment of the present application. The execution body of the method in FIG. 1 may be a server or a terminal device, wherein the server may be an independent server, or It can be a server cluster consisting of multiple servers. As shown in Figure 1, the method at least includes the following steps:

S101, performing a first risk identification on a target account according to a resource transfer request to obtain a first risk identification result;

The resource transfer request carries the identifier of the initiator of resource transfer and the identifier of the receiver of resource transfer (that is, the target account identifier). When making a transfer request, first identify the fraud risk of this remittance transaction, and obtain the fraud risk identification result, that is, to determine whether there is a fraud risk in this remittance transaction, and then determine that this remittance transaction is the victim who is deceived to fraudulently. Whether the fraudulent remittance to the target account provided by the sender, or the normal remittance to the legitimate account provided by the resource transfer recipient under the knowledge of the resource transfer initiator.

S102, performing second risk identification on the target account according to the resource transfer request, to obtain a second risk identification result;

Among them, for the embodied transaction, the resource transfer out request carries the resource transfer out initiator identifier (namely the target account identifier); for the transfer transaction, the resource transfer out request carries the resource transfer out initiator identifier ( Namely, the target account ID) and the resource transfer recipient ID. Specifically, taking the transfer from the target account to the resource transfer recipient as an example, when a transfer request is received, first identify the risk of selling stolen goods for this transfer transaction, and obtain the information about selling stolen goods. The result of risk identification, that is, to determine the degree of risk of selling stolen goods in this transfer transaction.

S103, according to the above-mentioned first risk identification result and the above-mentioned second risk identification result, determine the resource transfer risk monitoring result of the target account.

Specifically, for a certain target account, when multiple resource transfer initiators transfer resources to the target account, each resource transfer request corresponds to a first risk identification result; After the initiator transfers resources to the target account, when the target account initiates a resource transfer request, first obtain the second risk identification result based on the resource transfer request, and then combine the multiple first risk identification results obtained earlier and The second risk identification result is to conduct a comprehensive judgment of fraudulent sale of stolen goods, and finally determine whether there is a risk of resource transfer in the resource transfer request, and then determine whether the resource transfer is the fraudster illegally transferring the illegal income from the target account, or whether the user transfers the resources from the target account. Legitimate gains are normally transferred out.

In the embodiment of the present application, the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained; the second risk identification is performed on the target account according to the resource transfer request, and the second risk identification result is obtained; The first risk identification result and the second risk identification result are used to determine the resource transfer risk monitoring results of the target account, so that the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent sales of stolen goods can be detected in a timely manner, thereby minimizing the number of victims. At the same time, the final resource transfer risk monitoring result is determined by combining the transfer-in risk identification results and the transfer-out risk identification results, which improves the accuracy of the determination of fraudulent sales of stolen goods.

The above S101 performs first risk identification on the target account according to the resource transfer request, and obtains a first risk identification result, which specifically includes:

Obtain first association information related to the resource transfer request, where the first association information includes at least one of originating account information, target account information and first resource transfer information.

Specifically, the first associated information includes multi-dimensional features related to the resource transfer request, and the originating account information may include basic account attributes such as the account opening name, account opening bank, account opening date, and historical transaction records of the originating account; the target account information may include: Including basic account attributes, terminal behavior, terminal environment, account evaluation and other account information, the basic attributes of the account include the target account's account name, account opening bank, account opening date, historical transaction records, maturity, current assets, authentication information, contract information, Contacts, friends, etc. The terminal behavior includes mobile terminal operation records, browsing records, and social records. The terminal environment includes account login devices and account login cities. The account evaluation includes account reputation, account penalties, and account reports. ; The first resource transfer information may include the payment status of the initiating account, the collection status of the target account, and the interpersonal relationship between the initiator and the receiver, and the payment status includes: transaction amount, number of transactions per capita, amount variance, transaction success The collection status includes: account aggregation, account city number, and account cumulative collection amount. The interpersonal relationship between the initiator and the receiver includes: the initiator and the payee are friends, relatives, classmates Relationships, subordinate relationships, or stranger relationships, etc.

The first risk identification model is used to perform first risk identification on the target account according to the obtained first association information, and a first risk identification result is obtained, wherein the first risk identification model may be a neural network model.

Specifically, the above neural network model is obtained by training in the following ways:

Obtaining a plurality of transfer-in risk training samples, wherein the transfer-in risk training samples include: positive samples representing normal transfer-in transactions and negative samples representing fraudulent behaviors;

Based on the above-mentioned transfer-in risk training samples, the relevant model parameters in the neural network model are trained and updated, wherein the neural network model depicts the income and risk characteristics of the payee's collection.

Next, as shown in Figure 2, the acquired first associated information is input into the pre-trained neural network model, and the neural network model is obtained to score the resource transfer request based on the first associated information, and obtain the first A risk identification result, the first risk identification result may be a specific risk value or a risk level. During specific implementation, the pre-trained neural network model is used to respectively score the multi-dimensional features in the first associated information, and the first risk identification result is determined according to the comprehensive score of each dimensional feature.

Further, considering that in the case of extremely high risk of resource transfer, the resource transfer transaction needs to be managed and controlled in a timely manner, which transfer control method to use can be determined according to the identified transfer risk degree, so as to realize the realization of In the process of transferring resources to the target account, the transaction behavior is appropriately managed and controlled. Based on this, as shown in FIG. 3, the above S101 performs the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result. After that, also include:

S104, according to the obtained first risk identification result, determine whether to respond to the received resource transfer request.

Specifically, taking the transfer-in risk level as the first risk identification result as an example, if the transfer-in risk level is greater than the preset level threshold, it means that the current resource transfer is likely to be a fraudulent transfer, and it is necessary to temporarily stop responding to resources For the transfer-in business, determine the corresponding transfer-in management and control methods to conduct timely management and control.

If it is determined that there is no response, S105 is executed to trigger execution of the transfer-in management and control mode corresponding to the first risk identification result.

For example, if the transfer-in risk level is greater than the first preset level threshold and smaller than the second preset level threshold, send the transfer risk prompt information to the resource transfer initiator, so as to improve the user's vigilance; if the transfer-in risk level is greater than the first preset level threshold The second preset level threshold indicates that the current transfer-in transaction failed. In the specific implementation, more preset level thresholds can be set to determine which preset level threshold range the transfer-in risk level falls into, and select the same preset level. The transfer-in control method corresponding to the threshold interval.

If the response is determined, S106 is executed to trigger execution of the resource transfer service corresponding to the resource transfer request.

Wherein, the above S102 performs second risk identification on the target account according to the resource transfer request, and obtains a second risk identification result, which specifically includes:

Acquire second association information related to the resource transfer-out request, where the second association information includes at least one of target account information, second resource transfer information, and receiving account information.

Specifically, the second association information includes multi-dimensional features related to the resource transfer request, the target account information may include basic account attributes, terminal behavior, terminal environment, and account evaluation, and the basic account attributes include the account opening name of the target account, account opening Bank, account opening date, historical transaction records, maturity, current assets, authentication information, contract information, address book, friend information, etc. The terminal behavior includes mobile terminal operation records, browsing records, social records, and the terminal environment includes account login equipment , the account login city, the overall fraud degree of the account login city, the account evaluation includes account credit, account punishment, and account reporting; the second resource transfer information may include resource transfer, resource expenditure behavior; the receiving account information Including account creditworthiness, account penalties, account reports, account collections, etc.

The second risk identification model is used to perform second risk identification on the target account according to the obtained second association information, and a second risk identification result is obtained, wherein the second risk identification model may be a gradient boosting tree model (GBRT, Gradient Boosting tree model). Regression Tree).

Specifically, the above gradient boosting tree model is obtained by training as follows:

Obtaining a plurality of transfer-out risk training samples, wherein the transfer-out risk training samples include: positive samples representing normal transfer-out transactions and negative samples representing behavior of selling stolen goods;

Based on the above-mentioned transfer-out risk training samples, the relevant model parameters in the gradient boosting tree model are trained and updated.

Next, as shown in FIG. 4 , the obtained second association information is input into the pre-trained gradient boosting tree model, and the gradient boosting tree model is obtained to perform a transfer-out risk score for the resource transfer-out request based on the second association information, A second risk identification result is obtained, and the second risk identification result may be a specific risk value or a risk level. In a specific implementation, the pre-trained gradient boosting tree model is used to score the multi-dimensional features in the second associated information respectively, and the second risk identification result is determined according to the comprehensive score of each dimensional feature.

Wherein, the above-mentioned S103 determines the resource transfer risk monitoring result of the target account according to the above-mentioned first risk identification result and the above-mentioned second risk identification result, as shown in FIG. 5 , and specifically includes:

S1031: Determine the transfer-in risk identification results according to the multiple first risk identification results of the target account obtained previously.

Specifically, for a certain target account, when multiple resource transfer initiators transfer resources to the target account, each resource transfer request corresponds to a first risk identification result, based on multiple first risks Identification result, determine the transfer-in risk identification result, the transfer-in risk identification result may be one identification result among multiple first risk identification results, for example, the first risk identification result representing the highest risk degree, or the newly obtained first risk identification result. The risk identification result, the transferred-in risk identification result may also be a comprehensive result of multiple first risk identification results, for example, the weighted average risk of multiple risk identification results, or the cumulative risk of multiple risk identification results.

S1032, using a third risk identification model to determine at least one resource transfer risk identification strategy according to the transfer-in risk identification result and the second risk identification result, where the third risk identification model may be a classification regression tree model.

Specifically, each determined combination of the transfer-in risk identification result and the second risk identification result constitutes a resource transfer risk identification strategy. For example, the resource transfer risk identification strategy includes: the first risk identification result representing the highest risk degree and The combination of the second risk identification result, the combination of the newly obtained first risk identification result and the second risk identification result, the weighted average risk of multiple first risk identification results and the combination of the second risk identification result, the multiple first risk identification results The cumulative risk of the identification result and the combination of the second risk identification result, etc., the more types of identified transfer-in risk identification results, the more resource transfer risk identification strategies identified.

S1033, if at least one of the determined resource transfer risk identification strategies satisfies a preset condition, determine the target account as a risk account.

Specifically, each resource transfer risk identification strategy corresponds to its own constraint, and the constraint includes: a first constraint and a second constraint, wherein the first constraints corresponding to different resource transfer risk identification strategies are different from each other, For a certain resource transfer risk identification strategy, it is necessary to judge whether the transfer-in risk identification result satisfies the first constraint corresponding to the resource transfer risk identification strategy, and judge whether the second risk identification result satisfies the resource transfer risk identification strategy. the corresponding second constraint. For example, for the combination of the first risk identification result representing the highest risk degree and the second risk identification result, determine whether the first risk identification result representing the highest risk degree satisfies the first constraint condition, and determine whether the second risk identification result The second constraint condition is satisfied, and if both are satisfied, it is determined that the resource transfer risk identification strategy satisfies the preset condition.

Specifically, the above classification and regression tree model is obtained by training as follows:

Obtaining a plurality of resource transfer risk training samples, wherein the resource transfer risk training samples include: a historical first risk identification result for fraudulent behaviors, and a historical second risk identification result for stolen stolen behavior;

Based on the above resource transfer risk training samples, the constraints corresponding to each resource transfer risk identification strategy are obtained, wherein the constraints include: a first constraint and a second constraint, the first constraint corresponds to the transfer-in risk identification result, The second constraint condition corresponds to the second risk identification result;

The relevant model parameters in the classification and regression tree model are updated according to the obtained constraints corresponding to each resource transfer risk identification strategy. The classification and regression tree model combines the transfer-in risk identification result obtained by the neural network model and the transfer-out obtained by the gradient boosting tree model. The risk identification results are correlated to avoid the situation of single identification omission.

Next, as shown in FIG. 6 , input multiple first risk identification results and second risk identification results of the target account obtained earlier into the pre-trained classification and regression tree model, and obtain the output of the classification and regression tree model. Each resource transfer risk identification strategy is determined, whether each resource transfer risk identification strategy satisfies its corresponding preset conditions, and the resource transfer risk monitoring result is obtained.

In the embodiment provided by this application, in the process of determining the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result, a classification regression tree model (CRT, ClassificationRegression Tree) is used. The model selection index is simple, based on a number of simple identification strategies to classify the objects to be identified, combined with the first risk identification result obtained by using the neural network model and the second risk identification result obtained by using the gradient boosting tree model to comprehensively determine the risk of resource transfer. Improve the accuracy of resource transfer risk monitoring results.

As shown in Figure 7, a schematic diagram of the realization principle of the resource transfer risk identification of the target account is given. In Figure 7, there are multiple target users to be monitored, ☆ represents a risk account with fraudulent sales of stolen goods, and O represents a legal transaction. There is a certain misjudgment rate from the identification results obtained by the neural network model for individual risk identification. From the identification results obtained through the gradient boosting tree model for individual risk identification, there is also a certain misjudgment rate. Combining the identification results obtained through the neural network model for individual risk identification and the identification results obtained through the gradient boosting tree model for individual risk identification, and then through the classification and regression tree module for comprehensive identification of resource transfer risks, it can be seen that the target account is improved. accuracy of resource transfer risk identification.

Further, considering that the target account needs to be managed and controlled in a timely manner when the risk of resource transfer is extremely high, the control method to be adopted can be determined according to the determined risk degree of resource transfer, so as to realize the fraudsters in the process of selling off resources. Targeted and reasonable management and control of the target account, based on this, as shown in Figure 8, after determining the target account as a risk account, it also includes:

S107, according to the resource transfer risk identification strategy that satisfies the preset condition, determine the transfer control method of the target account.

Specifically, taking the determination of the transfer-out management and control method based on the number of resource transfer risk identification strategies that meet the preset conditions as an example, if the number of resource transfer risk identification strategies that meet the preset conditions is greater than the preset number threshold, it means that the current resource transfer The possibility of fraudulent sales of stolen goods is relatively high. It is necessary to temporarily stop responding to the resource transfer business, and determine the corresponding transfer control method for timely management and control.

S108 , triggering the execution of the determined transfer-out control method to control the target account.

For example, if the number of resource transfer risk identification strategies that meet the preset conditions is greater than the first preset number threshold and less than the second preset number threshold, an authentication request is sent to the target account to further identify the initiator of the resource transfer. Verification, if the verification is passed, then respond to the resource transfer out business; if the number of resource transfer risk identification strategies that meet the preset conditions is greater than the second preset number threshold, it will prompt the transfer out transaction to fail. In the specific implementation, you can set For more preset quantity thresholds, determine which preset quantity threshold range the quantity of the resource transfer risk identification strategy of the preset conditions falls into, and select the transfer-out control method corresponding to the preset quantity threshold range. In addition, other The transfer-out management and control method is determined by the method, for example, the transfer-out management and control method is determined according to the type of the resource transfer risk identification strategy that satisfies the preset conditions, and so on.

In the resource transfer monitoring method in the embodiment of the present application, the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained; the second risk identification is performed on the target account according to the resource transfer request, and the second risk is obtained. Identification result; according to the first risk identification result and the second risk identification result, determine the resource transfer risk monitoring result of the target account. In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Corresponding to the resource transfer monitoring method described above in FIGS. 1 to 8 , based on the same technical concept, another embodiment of the present application also provides a resource transfer monitoring method, and FIG. 9 is a schematic diagram of the resource transfer monitoring method provided by the embodiment of the present application. In the first schematic flowchart, the execution body of the method in FIG. 9 may be a server or a terminal device, wherein the server may be an independent server or a server cluster composed of multiple servers. As shown in Figure 9, the method at least includes the following steps:

S901, using a first risk identification model to perform first risk identification on the target account according to the resource transfer request, to obtain a first risk identification result; wherein the resource transfer request carries the resource transfer initiator identifier and the resource transfer receiver Party ID (namely the target account ID), specifically, taking the resource transfer initiator remittance to the target account as an example, when receiving the transfer transfer request, first use the first risk identification model to identify the fraud risk of this remittance transaction , to obtain the fraud risk identification result, that is, to determine whether there is a fraud risk in this remittance transaction, and then determine whether this remittance transaction is a fraudulent remittance to the target account provided by the victim to the fraudster under the condition of being deceived, or whether the resource is transferred to the initiator in the Under the circumstance of knowing, transfer the resources to the legal account provided by the recipient and make normal remittances.

Specifically, for the specific implementation manner of step S901, refer to step S101, which will not be repeated here.

S902, using the second risk identification model to perform second risk identification on the target account according to the resource transfer request, to obtain a second risk identification result; wherein, for the embodied transaction, the resource transfer request carries the resource transfer initiator ID (that is, the target account ID); for the transfer transaction, the resource transfer out request carries the resource transfer out initiator ID (that is, the target account ID) and the resource transfer recipient ID. Taking the transfer out of the receiver as an example, when a transfer request is received, the second risk identification model is used to first identify the risk of stolen stolen goods in this transfer transaction, and the identification result of the stolen stolen goods risk is obtained, that is, the degree of the risk of stolen stolen goods in this transfer transaction is determined.

Specifically, for the specific implementation manner of step S902, refer to step S102, which will not be repeated here.

S903, using the third risk identification model to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result. For a certain target account, when multiple resource transfer initiators perform resource transfer to the target account, each resource transfer request corresponds to a first risk identification result obtained by using the first risk identification model ; After multiple resource transfer initiators perform resource transfer to the target account, when the target account initiates a resource transfer request, first use the second risk identification model to obtain the second risk identification result based on this resource transfer request, and then use the second risk identification model to obtain the second risk identification result. The third risk identification model is used to combine the multiple first risk identification results and the second risk identification results obtained earlier to conduct a comprehensive judgment on fraudulent disposal of stolen goods, and finally determine whether there is a resource transfer risk in the resource transfer request, and then determine the resource transfer out. Whether the fraudster illegally transfers the illegal income from the target account, or the user transfers the legitimate income from the target account normally.

Specifically, for the specific implementation manner of step S903, refer to step S103, which will not be repeated here.

In the embodiment of the present application, the first risk identification model is used to perform the first risk identification on the target account according to the resource transfer request, and the first risk identification result is obtained; the second risk identification model is used to perform the second risk identification on the target account according to the resource transfer request. Risk identification to obtain a second risk identification result; use the third risk identification model to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result, so that the real-time resources of the target account can be automatically monitored. Transfer monitoring, timely detect suspicious accounts with fraudulent sales of stolen goods, and minimize the losses of victims. At the same time, combined with the results of the transfer-in risk identification and the transfer-out risk identification results, the final resource transfer risk monitoring results are determined, which improves the fraudulent sales of stolen goods. The accuracy of behavioral determinations.

Wherein, at least one of the above-mentioned first risk identification model, the above-mentioned second risk identification model and the above-mentioned second risk identification model satisfies the following conditions:

The first risk identification model is a neural network model, the second risk identification model is a gradient boosting tree model, or the second risk identification model is a classification regression tree model.

Preferably, in the process of determining the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result, a classification regression tree model (CRT, Classification Regression Tree) is used, because the classification and regression tree model selection index is simple , based on a number of simple identification strategies to classify the objects to be identified, combined with the first risk identification result obtained by using the neural network model and the second risk identification result obtained by using the gradient boosting tree model to comprehensively determine the risk of resource transfer, which improves the resource transfer risk. Accuracy of risk monitoring results.

Further, considering that in the case of extremely high risk of resource transfer, the resource transfer transaction needs to be managed and controlled in a timely manner, which transfer control method to use can be determined according to the identified transfer risk degree, so as to realize the realization of In the process of transferring resources to the target account, the transaction behavior is appropriately managed and controlled. Based on this, as shown in FIG. 10, in S901, the first risk identification model is used to identify the first risk of the target account according to the resource transfer request. After obtaining the first risk identification result, it also includes:

S904, according to the obtained first risk identification result, determine whether to respond to the received resource transfer request; wherein, the specific implementation of step S904 refers to step S104, which is not repeated here.

If it is determined that there is no response, S905 is executed to trigger execution of the transfer-in management and control mode corresponding to the first risk identification result; wherein, the specific implementation of step S905 refers to step S105, which is not repeated here.

If the response is determined, S906 is executed to trigger execution of the resource transfer service corresponding to the resource transfer request; wherein, for the specific implementation of step S906, refer to step S106, which will not be repeated here.

Further, considering that the target account needs to be managed and controlled in a timely manner when the risk of resource transfer is extremely high, the control method to be adopted can be determined according to the determined risk degree of resource transfer, so as to realize the fraudsters in the process of selling off resources. Targeted and reasonable management and control of the target account, based on this, as shown in Figure 11, after determining the resource transfer risk monitoring result of the target account, it also includes:

S907, determine whether the determined resource transfer risk monitoring result satisfies a preset condition; wherein, the resource transfer risk monitoring result includes: identification results of each resource transfer risk identification strategy.

If so, execute S908 to trigger the execution of the transfer-out management and control method corresponding to the resource transfer risk monitoring result to manage and control the target account; wherein, for the specific implementation of step S908, refer to steps S107 to S108, which will not be repeated here;

If not, execute S909 to trigger execution of the resource transfer-out service corresponding to the resource transfer-out request.

In the resource transfer monitoring method in the embodiment of the present application, the first risk identification model is used to identify the first risk of the target account according to the resource transfer request, and the first risk identification result is obtained; The target account performs second risk identification to obtain a second risk identification result; the third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result. In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

It should be noted that another embodiment of the present application and an embodiment of the present application are based on the same inventive concept, so the specific implementation of this embodiment may refer to the implementation of the foregoing resource transfer monitoring method, and repeated details will not be repeated.

Corresponding to the resource transfer monitoring methods described above in FIGS. 1 to 8 , based on the same technical concept, an embodiment of the present application also provides a resource transfer monitoring device, and FIG. 12 is the first example of the resource transfer monitoring device provided by the embodiment of the present application. A schematic diagram of the composition of these modules, the device is used to execute the resource transfer monitoring method described in FIG. 1 to FIG. 8 , as shown in FIG. 12 , the device includes: a first risk identification module 1201, a second risk identification module 1202 and a monitoring result determination module 1203, the first risk identification module 1201, the second risk identification module 1202 and the monitoring result determination module 1203 are connected in sequence.

In a specific embodiment, the first risk identification module 1201 is configured to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

The second risk identification module 1202 is configured to perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

The monitoring result determination module 1203 is configured to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

Optionally, the first risk identification module 1201 is specifically used for:

Acquiring first associated information related to the resource transfer request, wherein the first associated information includes: at least one of initiating account information, target account information, and first resource transfer information;

A neural network model is used to perform first risk identification on the target account according to the first associated information, and a first risk identification result is obtained.

Optionally, as shown in Figure 13, the above-mentioned device further includes:

The first control module 1204 is configured to determine, according to the first risk identification result, whether to respond to the resource transfer request; if it is determined not to respond, trigger execution of the transfer control mode corresponding to the first risk identification result.

Optionally, the second risk identification module 1202 is specifically configured to:

Acquiring second association information related to the resource transfer-out request, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information;

The second risk identification is performed on the target account according to the second association information by using the gradient boosting tree model, and a second risk identification result is obtained.

Optionally, the monitoring result determination module 1203 is specifically used for:

Determine the transfer-in risk identification results according to the multiple first risk identification results of the target account obtained previously;

Use a classification regression tree model to determine at least one resource transfer risk identification strategy according to the transfer-in risk identification result and the second risk identification result;

If at least one of the resource transfer risk identification strategies satisfies a preset condition, the target account is determined to be a risk account.

Optionally, the above device also includes:

The second control module 1205 is configured to, after determining that the target account is a risk account, according to the resource transfer risk identification strategy that satisfies the preset conditions, determine the transfer-out management and control method of the target account; trigger the execution of the transfer-out The management and control method is used to manage and control the target account.

The resource transfer monitoring device in the embodiment of the present application performs a first risk identification on a target account according to a resource transfer request to obtain a first risk identification result; and performs a second risk identification on the target account according to a resource transfer request to obtain a second risk Identification result; according to the first risk identification result and the second risk identification result, determine the resource transfer risk monitoring result of the target account. In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

In another specific embodiment, the first risk identification module 1201 is configured to use the first risk identification model to perform first risk identification on the target account according to the resource transfer request to obtain a first risk identification result;

The second risk identification module 1202 is configured to use the second risk identification model to perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

The monitoring result determination module 1203 is configured to use the third risk identification model to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

Optionally, at least one of the first risk identification model, the second risk identification model and the second risk identification model satisfies the following conditions:

The first risk identification model is a neural network model, the second risk identification model is a gradient boosting tree model, or the second risk identification model is a classification regression tree model.

Optionally, the above device also includes:

The first control module 1204 is configured to determine, according to the first risk identification result, whether to respond to the resource transfer request; if it is determined not to respond, trigger execution of the transfer control mode corresponding to the first risk identification result.

Optionally, the above device also includes:

The second control module 1205 is configured to trigger the execution of a transfer-out control method corresponding to the resource transfer risk monitoring result to control the target account if the resource transfer risk monitoring result satisfies a preset condition.

The resource transfer monitoring device in the embodiment of the present application uses the first risk identification model to perform the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; uses the second risk identification model to identify the target account according to the resource transfer request. The target account performs second risk identification to obtain a second risk identification result; the third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result. In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

It should be noted that the resource transfer monitoring device provided by the embodiment of the present application and the aforementioned resource transfer monitoring method are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the aforementioned resource transfer monitoring method, and repeated details will not be repeated.

Further, corresponding to the methods shown in FIG. 1 to FIG. 8 above, based on the same technical concept, an embodiment of the present application further provides a resource transfer monitoring device, which is used to execute the above-mentioned resource transfer monitoring method, as shown in FIG. 14 . shown.

The resource transfer monitoring devices may vary greatly due to different configurations or performances, and may include one or more processors 1401 and a memory 1402, and the memory 1402 may store one or more storage applications or data. Among them, the memory 1402 may be short-lived storage or persistent storage. The application program stored in the memory 1402 may include one or more modules (not shown), each module may include a series of computer-executable instructions in the resource transfer monitoring device. Still further, the processor 1401 may be arranged to communicate with the memory 1402 to execute a series of computer-executable instructions in the memory 1402 on the resource transfer monitoring device. The resource transfer monitoring device may also include one or more power supplies 1403, one or more wired or wireless network interfaces 1404, one or more input and output interfaces 1405, one or more keyboards 1406, and the like.

In a specific embodiment, the resource transfer monitoring device includes a memory, and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and Each module may include a series of computer-executable instructions in a resource transfer monitoring apparatus, and the one or more programs configured to be executed by one or more processors include computer-executable instructions for:

Perform the first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result;

Perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

According to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined.

In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Optionally, when the computer-executable instruction is executed, the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained, including:

Acquiring first associated information related to the resource transfer request, wherein the first associated information includes: at least one of initiating account information, target account information, and first resource transfer information;

A neural network model is used to perform first risk identification on the target account according to the first associated information, and a first risk identification result is obtained.

Optionally, the computer-executable instructions, when executed, also include computer-executable instructions for performing the following:

After the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained, the method further includes:

According to the first risk identification result, determine whether to respond to the resource transfer request;

If it is determined that there is no response, trigger execution of the transfer-in control method corresponding to the first risk identification result.

Optionally, when the computer-executable instruction is executed, the second risk identification is performed on the target account according to the resource transfer request to obtain a second risk identification result, including:

Acquiring second association information related to the resource transfer-out request, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information;

The second risk identification is performed on the target account according to the second association information by using the gradient boosting tree model, and a second risk identification result is obtained.

Optionally, when the computer-executable instruction is executed, the determination of the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result includes:

Determine the transfer-in risk identification results according to the multiple first risk identification results of the target account obtained previously;

Use a classification regression tree model to determine at least one resource transfer risk identification strategy according to the transfer-in risk identification result and the second risk identification result;

If at least one of the resource transfer risk identification strategies satisfies a preset condition, the target account is determined to be a risk account.

Optionally, the computer-executable instructions, when executed, also include computer-executable instructions for performing the following:

After determining that the target account is a risk account, the method further includes:

According to the resource transfer risk identification strategy that satisfies the preset conditions, determine the transfer control method of the target account;

Trigger to execute the transfer-out control method to control the target account.

The resource transfer monitoring device in the embodiment of the present application performs first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; and performs second risk identification on the target account according to the resource transfer request, and obtains the second risk Identification result; according to the first risk identification result and the second risk identification result, determine the resource transfer risk monitoring result of the target account. It can be seen that through the resource transfer monitoring device in the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent sales of stolen goods can be detected in time, so as to minimize the losses of victims. The identification result and the transfer-out risk identification result determine the final resource transfer risk monitoring result, which improves the accuracy of the determination of fraudulent sales of stolen goods.

In another specific embodiment, the resource transfer monitoring device includes a memory, and one or more programs, wherein one or more programs are stored in the memory, and the one or more programs may include one or more modules, And each module may include a series of computer-executable instructions in a resource transfer monitoring apparatus, and the one or more programs configured to be executed by one or more processors include computer-executable instructions for:

Use the first risk identification model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

Use the second risk identification model to perform second risk identification on the target account according to the resource transfer request, and obtain a second risk identification result;

The third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Optionally, when the computer-executable instructions are executed, at least one of the first risk identification model, the second risk identification model and the second risk identification model satisfies the following conditions:

The first risk identification model is a neural network model, the second risk identification model is a gradient boosting tree model, or the second risk identification model is a classification regression tree model.

Optionally, the computer-executable instructions, when executed, also include computer-executable instructions for performing the following:

After the first risk identification model is used to identify the target account according to the resource transfer request, and the first risk identification result is obtained, the method further includes:

According to the first risk identification result, determine whether to respond to the resource transfer request;

If it is determined that there is no response, trigger execution of the transfer-in control method corresponding to the first risk identification result.

Optionally, the computer-executable instructions, when executed, also include computer-executable instructions for performing the following:

After determining the resource transfer risk monitoring result of the target account, the method further includes:

If the resource transfer risk monitoring result satisfies a preset condition, triggering and executing a transfer-out management and control method corresponding to the resource transfer risk monitoring result to manage and control the target account.

The resource transfer monitoring device in the embodiment of the present application uses the first risk identification model to perform the first risk identification on the target account according to the resource transfer request, and obtains the first risk identification result; uses the second risk identification model to identify the target account according to the resource transfer request. The target account performs second risk identification to obtain a second risk identification result; the third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result. It can be seen that through the resource transfer monitoring device in the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent sales of stolen goods can be detected in time, so as to minimize the losses of victims. The identification result and the transfer-out risk identification result determine the final resource transfer risk monitoring result, which improves the accuracy of the determination of fraudulent sales of stolen goods.

It should be noted that the resource transfer monitoring device provided by the embodiment of the present application and the aforementioned resource transfer monitoring method are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the aforementioned resource transfer monitoring method, and repeated details will not be repeated.

Further, corresponding to the methods shown in FIG. 1 to FIG. 8 above, based on the same technical concept, an embodiment of the present application further provides a storage medium for storing computer-executable instructions. In a specific embodiment, the The storage medium can be a U disk, an optical disk, a hard disk, etc., when the computer-executable instructions stored in the storage medium are executed by the processor, the following processes can be implemented:

Perform the first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result;

Perform second risk identification on the target account according to the resource transfer request to obtain a second risk identification result;

According to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined.

In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained, including:

Acquiring first associated information related to the resource transfer request, wherein the first associated information includes: at least one of initiating account information, target account information, and first resource transfer information;

A neural network model is used to perform first risk identification on the target account according to the first associated information, and a first risk identification result is obtained.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, the following processes are also implemented:

After the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained, the method further includes:

According to the first risk identification result, determine whether to respond to the resource transfer request;

If it is determined that there is no response, trigger execution of the transfer-in control method corresponding to the first risk identification result.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, the second risk identification is performed on the target account according to the resource transfer request to obtain a second risk identification result, including:

Acquiring second association information related to the resource transfer-out request, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information;

The second risk identification is performed on the target account according to the second association information by using the gradient boosting tree model, and a second risk identification result is obtained.

Optionally, when the computer-executable instruction stored in the storage medium is executed by the processor, the resource transfer risk monitoring result of the target account is determined according to the first risk identification result and the second risk identification result. ,include:

Determine the transfer-in risk identification results according to the multiple first risk identification results of the target account obtained previously;

Use a classification regression tree model to determine at least one resource transfer risk identification strategy according to the transfer-in risk identification result and the second risk identification result;

If at least one of the resource transfer risk identification strategies satisfies a preset condition, the target account is determined to be a risk account.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, the following processes are also implemented:

After determining that the target account is a risk account, the method further includes:

According to the resource transfer risk identification strategy that satisfies the preset conditions, determine the transfer control method of the target account;

Trigger to execute the transfer-out control method to control the target account.

When the computer-executable instructions stored in the storage medium in the embodiments of the present application are executed by the processor, the first risk identification is performed on the target account according to the resource transfer request, and the first risk identification result is obtained; the target account is identified according to the resource transfer request. A second risk identification is performed to obtain a second risk identification result; according to the first risk identification result and the second risk identification result, the resource transfer risk monitoring result of the target account is determined. It can be seen that through the storage medium in the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent sales of stolen goods can be detected in time, so as to minimize the losses of victims. And transfer out risk identification results, determine the final resource transfer risk monitoring results, improve the accuracy of fraudulent sales of stolen goods.

In another specific embodiment, the storage medium can be a U disk, an optical disk, a hard disk, etc., and the computer-executable instructions stored in the storage medium can implement the following processes when executed by the processor:

Use the first risk identification model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result;

Use the second risk identification model to perform second risk identification on the target account according to the resource transfer request, and obtain a second risk identification result;

The third risk identification model is used to determine the resource transfer risk monitoring result of the target account according to the first risk identification result and the second risk identification result.

In the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent and stolen stolen goods can be detected in time, so as to minimize the losses of victims. , to determine the final resource transfer risk monitoring result, and improve the accuracy of the determination of fraudulent sale of stolen goods.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, at least one of the first risk identification model, the second risk identification model, and the second risk identification model satisfies the following conditions: :

The first risk identification model is a neural network model, the second risk identification model is a gradient boosting tree model, or the second risk identification model is a classification regression tree model.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, the following processes are also implemented:

After the first risk identification model is used to identify the target account according to the resource transfer request, and the first risk identification result is obtained, the method further includes:

According to the first risk identification result, determine whether to respond to the resource transfer request;

If it is determined that there is no response, trigger execution of the transfer-in control method corresponding to the first risk identification result.

Optionally, when the computer-executable instructions stored in the storage medium are executed by the processor, the following processes are also implemented:

After determining the resource transfer risk monitoring result of the target account, the method further includes:

If the resource transfer risk monitoring result satisfies a preset condition, triggering and executing a transfer-out management and control method corresponding to the resource transfer risk monitoring result to manage and control the target account.

When the computer-executable instructions stored in the storage medium in the embodiments of the present application are executed by the processor, the first risk identification model is used to identify the target account according to the resource transfer request, and the first risk identification result is obtained; The second risk identification model performs the second risk identification on the target account according to the resource transfer request, and obtains the second risk identification result; the third risk identification model is used to determine the target account's Resource transfer risk monitoring results. It can be seen that through the storage medium in the embodiment of the present application, the real-time resource transfer of the target account can be automatically monitored, and suspicious accounts with fraudulent sales of stolen goods can be detected in time, so as to minimize the losses of victims. And transfer out risk identification results, determine the final resource transfer risk monitoring results, improve the accuracy of fraudulent sales of stolen goods.

It should be noted that the storage medium provided in this embodiment of the present application and the foregoing resource transfer monitoring method are based on the same inventive concept, so the specific implementation of this embodiment may refer to the implementation of the foregoing resource transfer monitoring method, and repeated details will not be repeated.

In the 1990s, improvements in a technology could be clearly differentiated between improvements in hardware (eg, improvements to circuit structures such as diodes, transistors, switches, etc.) or improvements in software (improvements in method flow). However, with the development of technology, the improvement of many methods and processes today can be regarded as a direct improvement of the hardware circuit structure. Designers almost get the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be realized by hardware entity modules. For example, a Programmable Logic Device (PLD) (eg, Field Programmable Gate Array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. It is programmed by the designer to "integrate" a digital system on a PLD without having to ask the chip manufacturer to design and manufacture a dedicated integrated circuit chip. And, instead of making integrated circuit chips by hand, these days, much of this programming is done using software called a "logic compiler", which is similar to the software compiler used in program development and writing, but before compiling The original code also has to be written in a specific programming language, which is called Hardware Description Language (HDL), and there is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language) , AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (RubyHardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. It should also be clear to those skilled in the art that a hardware circuit for implementing the logic method process can be easily obtained by simply programming the method process in the above-mentioned several hardware description languages and programming it into the integrated circuit.

The controller may be implemented in any suitable manner, for example, the controller may take the form of eg a microprocessor or processor and a computer readable medium storing computer readable program code (eg software or firmware) executable by the (micro)processor , logic gates, switches, application specific integrated circuits (ASICs), programmable logic controllers and embedded microcontrollers, examples of controllers include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicon Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that, in addition to implementing the controller in the form of pure computer-readable program code, the controller can be implemented as logic gates, switches, application-specific integrated circuits, programmable logic controllers and embedded devices by logically programming the method steps. The same function can be realized in the form of a microcontroller, etc. Therefore, such a controller can be regarded as a hardware component, and the devices included therein for realizing various functions can also be regarded as a structure within the hardware component. Or even, the means for implementing various functions can be regarded as both a software module implementing a method and a structure within a hardware component.

The systems, devices, modules or units described in the above embodiments may be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or A combination of any of these devices.

For the convenience of description, when describing the above device, the functions are divided into various units and described respectively. Of course, when implementing the present application, the functions of each unit may be implemented in one or more software and/or hardware.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-persistent memory in computer readable media, random access memory (RAM) and/or non-volatile memory in the form of, for example, read only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media includes both persistent and non-permanent, removable and non-removable media, and storage of information may be implemented by any method or technology. Information may be computer readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Flash Memory or other memory technology, Compact Disc Read Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, excludes transitory computer-readable media, such as modulated data signals and carrier waves.

It should also be noted that the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device comprising a series of elements includes not only those elements, but also Other elements not expressly listed, or which are inherent to such a process, method, article of manufacture, or apparatus are also included. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article of manufacture or device that includes the element.

It will be appreciated by those skilled in the art that the embodiments of the present application may be provided as a method, a system or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including storage devices.

Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to the partial descriptions of the method embodiments.

The above descriptions are merely examples of the present application, and are not intended to limit the present application. Various modifications and variations of this application are possible for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the scope of the claims of this application.

Claims (18)

1. a resource transfer monitoring method, is characterized in that, comprises: According to the resource transfer request, use the neural network model to identify the first risk of the target account, and obtain the first risk identification result; acquiring second association information related to the resource transfer-out request, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information; Using a gradient boosting tree model to perform second risk identification on the target account according to the second associated information, to obtain a second risk identification result; Determine the transfer-in risk identification result according to the first risk identification result, use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine a resource transfer risk identification strategy. A transfer risk identification strategy is used to determine the resource transfer risk monitoring result of the target account. 2. The method according to claim 1, wherein, according to the resource transfer request, the first risk identification is performed on the target account by using a neural network model, and the first risk identification result is obtained, comprising: Acquiring first associated information related to the resource transfer request, wherein the first associated information includes: at least one of initiating account information, target account information, and first resource transfer information; A neural network model is used to perform first risk identification on the target account according to the first associated information, and a first risk identification result is obtained. 3. The method according to claim 1, characterized in that, after the first risk identification is performed on the target account by using a neural network model according to the resource transfer request, and the first risk identification result is obtained, the method further comprises: According to the first risk identification result, determine whether to respond to the resource transfer request; If it is determined that there is no response, trigger execution of the transfer-in control method corresponding to the first risk identification result. 4. The method according to claim 1, characterized in that, according to the first risk identification result, the transfer-in risk identification result is determined, and a classification regression tree model is used to convert the transfer-in risk identification result and the second risk identification result. The risk identification results are correlated to determine a resource transfer risk identification strategy, and according to the resource transfer risk identification strategy, the resource transfer risk monitoring result of the target account is determined, including: Determine the transfer-in risk identification results according to the multiple first risk identification results of the target account obtained previously; Use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine at least one resource transfer risk identification strategy; If at least one of the resource transfer risk identification strategies satisfies a preset condition, the target account is determined to be a risk account. 5. The method according to claim 4, characterized in that, after determining that the target account is a risk account, the method further comprises: According to the resource transfer risk identification strategy that satisfies the preset conditions, determine the transfer control method of the target account; Trigger to execute the transfer-out control method to control the target account. 6. A resource transfer monitoring method, comprising: Use the neural network model to perform first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result; The second association information related to the resource transfer request is obtained by using a gradient boosting tree model, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information, and according to the The second associated information performs second risk identification on the target account to obtain a second risk identification result; Determine the transfer-in risk identification result according to the first risk identification result, use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine a resource transfer risk identification strategy. Transfer risk identification strategy, determine the resource transfer risk monitoring result of the target account; If the resource transfer risk monitoring result satisfies a preset condition, triggering and executing a transfer-out management and control method corresponding to the resource transfer risk monitoring result to manage and control the target account. 7. The method according to claim 6, characterized in that, after utilizing the neural network model to perform the first risk identification on the target account according to the resource transfer request, and after obtaining the first risk identification result, the method further comprises: According to the first risk identification result, determine whether to respond to the resource transfer request; If it is determined that there is no response, trigger execution of the transfer-in control method corresponding to the first risk identification result. 8. A resource transfer monitoring device, comprising: a first risk identification module, configured to perform first risk identification on the target account by using a neural network model according to the resource transfer request, and obtain a first risk identification result; A second associated information obtaining module, configured to obtain second associated information related to the resource transfer out request, wherein the second associated information includes at least one of target account information, second resource transfer information and receiving account information; A second risk identification module, configured to use a gradient boosting tree model to perform second risk identification on the target account according to the second associated information to obtain a second risk identification result; The monitoring result determination module is used to determine the transfer-in risk identification result according to the first risk identification result, and use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result to determine the resource transfer risk An identification strategy, according to the resource transfer risk identification strategy, to determine the resource transfer risk monitoring result of the target account. 9. The device according to claim 8, wherein the first risk identification module is specifically used for: Acquiring first associated information related to the resource transfer request, wherein the first associated information includes: at least one of initiating account information, target account information, and first resource transfer information; A neural network model is used to perform first risk identification on the target account according to the first associated information, and a first risk identification result is obtained. 10. The apparatus of claim 8, further comprising: The first control module is configured to determine whether to respond to the resource transfer request according to the first risk identification result; if it is determined not to respond, trigger execution of the transfer control mode corresponding to the first risk identification result. 11. The device according to claim 8, wherein the monitoring result determination module is specifically used for: Determine the transfer-in risk identification results according to the multiple first risk identification results of the target account obtained previously; Use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine at least one resource transfer risk identification strategy; If at least one of the resource transfer risk identification strategies satisfies a preset condition, the target account is determined to be a risk account. 12. The apparatus of claim 11, further comprising: The second control module is configured to, after determining that the target account is a risk account, according to the resource transfer risk identification strategy that satisfies the preset conditions, determine the transfer-out management and control mode of the target account; trigger the execution of the transfer-out management and control way to manage and control the target account. 13. A resource transfer monitoring device, comprising: a first risk identification module, configured to use a neural network model to perform first risk identification on the target account according to the resource transfer request, and obtain a first risk identification result; The second risk identification module is configured to obtain the second association information related to the resource transfer request by using the gradient boosting tree model, wherein the second association information includes the target account information, the second resource transfer information and the receiving account information. at least one, and perform second risk identification on the target account according to the second associated information to obtain a second risk identification result; The monitoring result determination module is used to determine the transfer-in risk identification result according to the first risk identification result, and use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result to determine the resource transfer risk an identification strategy, according to the resource transfer risk identification strategy, to determine the resource transfer risk monitoring result of the target account; The second control module is configured to trigger the execution of a transfer-out management and control method corresponding to the resource transfer risk monitoring result to control the target account if the resource transfer risk monitoring result satisfies a preset condition. 14. The apparatus of claim 13, further comprising: The first control module is configured to determine whether to respond to the resource transfer request according to the first risk identification result; if it is determined not to respond, trigger execution of the transfer control mode corresponding to the first risk identification result. 15. A resource transfer monitoring device, comprising: processor; and memory arranged to store computer-executable instructions which, when executed, cause the processor to: According to the resource transfer request, use the neural network model to identify the first risk of the target account, and obtain the first risk identification result; acquiring second association information related to the resource transfer-out request, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information; Using a gradient boosting tree model to perform second risk identification on the target account according to the second associated information, to obtain a second risk identification result; Determine the transfer-in risk identification result according to the first risk identification result, use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine a resource transfer risk identification strategy. A transfer risk identification strategy is used to determine the resource transfer risk monitoring result of the target account. 16. A resource transfer monitoring device, comprising: processor; and memory arranged to store computer-executable instructions which, when executed, cause the processor to: Use the neural network model to perform first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result; The second association information related to the resource transfer request is obtained by using a gradient boosting tree model, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information, and according to the The second associated information performs second risk identification on the target account to obtain a second risk identification result; Determine the transfer-in risk identification result according to the first risk identification result, use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine a resource transfer risk identification strategy. Transfer risk identification strategy, determine the resource transfer risk monitoring result of the target account; If the resource transfer risk monitoring result satisfies a preset condition, triggering the execution of a transfer-out management and control method corresponding to the resource transfer risk monitoring result to manage and control the target account. 17. A storage medium for storing computer-executable instructions, wherein the executable instructions implement the following processes when executed: According to the resource transfer request, use the neural network model to identify the first risk of the target account, and obtain the first risk identification result; acquiring second association information related to the resource transfer-out request, wherein the second association information includes at least one of target account information, second resource transfer information, and receiving account information; Using a gradient boosting tree model to perform second risk identification on the target account according to the second associated information, to obtain a second risk identification result; Determine the transfer-in risk identification result according to the first risk identification result, use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine a resource transfer risk identification strategy. A transfer risk identification strategy is used to determine the resource transfer risk monitoring result of the target account. 18. A storage medium for storing computer-executable instructions, wherein the executable instructions implement the following processes when executed: Use the neural network model to perform first risk identification on the target account according to the resource transfer request, and obtain the first risk identification result; The second association information related to the resource transfer request is obtained by using the gradient boosting tree model, wherein the second association information includes at least one of target account information, second resource transfer information and receiving account information, and according to the The second associated information performs second risk identification on the target account to obtain a second risk identification result; Determine the transfer-in risk identification result according to the first risk identification result, use a classification regression tree model to associate the transfer-in risk identification result with the second risk identification result, and determine a resource transfer risk identification strategy. Transfer risk identification strategy, determine the resource transfer risk monitoring result of the target account; If the resource transfer risk monitoring result satisfies a preset condition, triggering and executing a transfer-out management and control method corresponding to the resource transfer risk monitoring result to manage and control the target account.

Images